Trouble installing netscreen 5gt

[jcanon]

I'm totally new to netscreen firewalls, so I will post all details I can, cause I don't know what could be useful...

I'm trying to install a netscreen 5gt, starting from reseting the machine and using the initial configuratión wizard. I use NAT mode, trusted to untrusted mode, ip of trusted zone 10.0.0.40/255.0.0.0 not using DHCP, ip of untrusted zone is dinamic ip via dhcp.

I can conect and web manage device from trusted zone.

I can ping to internet (ping

http://www.yahoo.com)

from the firewall via console (using CLI), so Internet is active (untrusted interface show a working ip / dns).

I can't ping or have web access to internet from the internal trusted zone.

I can see (ping) the trusted interface on firewall from internal zone.

I can't see (ping) the untrusted interface on firewall from internal zone.

I read all getting started and users guide, but as I can see I should have internet access after finishing initial wizard...

Basically I can connect to trusted interface from internal network and can connect to internet from untrusted interface, but I can't pass data from trusted to untrusted interface, so I suppose I have a gateway or route problem, but I don't know what to do....

any ideas?

thanks in advance...

Juan Carlos

 

[Packet7]

Hello,

It sounds like you have either a routing issue or Policy. I'm guessing it's policy related since you can ping yahoo.com from the Trust Zone.

Try connecting to the NS via the WebUI. Go to, Polcies. Verofy that you have Source = Any, Dest = Any, Service = Any, Action = Permit from the Trust to Intrust zone. By default, there should be NO Untrust to Trust polices created.

If you have the Trust to Untrust Policy, go into the Policy and check that NAT is on. Click Edit, Advanced, Check the "Source Translation" DIP ON (None, Use Egress INT) option. This will resolve any NAT problems when trying to use Interface based NAT.

If you still have a problem, go in via the CLI and type: "get zone" and "get int". Paste the output on this site and I will have a look. Hope this helps.

Rgds,

John

 

[jcanon]

thanks for the ideas...

It's appears to be a machine problem, now the firewall shows error at start (flash programming it's gone), so I will have to download the system image and try again...

I'll tell if it works...

 

[Packet7]

Hey,

Sounds good. Good luck.

Rgds,

John

 

[MRJUL]

what's the easier to block the website? do I need the block port, URL or ip?

Thx
Richard